!164 Fix CVE-2022-44267,CVE-2022-44268 and CVE-2022-3213
From: @starlet-dx Reviewed-by: @gitee-cmd Signed-off-by: @gitee-cmd
This commit is contained in:
openeuler-ci-bot
Gitee
commit
ed14d4262f
53
CVE-2022-3213-pre1.patch
Normal file
53
CVE-2022-3213-pre1.patch
Normal file
@ -0,0 +1,53 @@
|
||||
From a854a0a8af977a1b67830f02a53d9eb4d877e10d Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Tue, 21 Jun 2022 15:06:58 -0400
|
||||
Subject: [PATCH] prevent possible buffer overflow
|
||||
|
||||
---
|
||||
coders/tiff.c | 15 ++++++++-------
|
||||
1 file changed, 8 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 49c1677cb7..2b64958930 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1903,9 +1903,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
*/
|
||||
extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=image->columns*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=image->columns*sizeof(uint32);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#endif
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
@@ -2002,11 +2002,12 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
number_pixels=(MagickSizeType) columns*rows;
|
||||
if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
- extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
|
||||
+ extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
+ TIFFTileSize(tiff));
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=image->columns*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=image->columns*sizeof(uint32);
|
||||
+ extent+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*tile_pixels));
|
||||
@@ -2101,9 +2102,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
number_pixels=(MagickSizeType) image->columns*image->rows;
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- number_pixels+=image->columns*sizeof(uint64);
|
||||
+ number_pixels+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- number_pixels+=image->columns*sizeof(uint32);
|
||||
+ number_pixels+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
|
||||
if (generic_info == (MemoryInfo *) NULL)
|
||||
22
CVE-2022-3213-pre2.patch
Normal file
22
CVE-2022-3213-pre2.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From b11d64704f46cedade2ca3cdcebbc8d1f315035e Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Tue, 21 Jun 2022 17:14:48 -0400
|
||||
Subject: [PATCH] correct copy/paste error
|
||||
|
||||
---
|
||||
coders/tiff.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 2b64958930..e2c6ca1093 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1905,7 +1905,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
54
CVE-2022-3213-pre3.patch
Normal file
54
CVE-2022-3213-pre3.patch
Normal file
@ -0,0 +1,54 @@
|
||||
From 309dfda1122f08fcf349b6f611b3b6df994d9297 Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Wed, 29 Jun 2022 19:40:56 -0400
|
||||
Subject: [PATCH] eliminate possible buffer overflow
|
||||
|
||||
---
|
||||
coders/tiff.c | 19 ++-----------------
|
||||
1 file changed, 2 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index e2c6ca1093..6bf4b112e1 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1901,12 +1901,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
/*
|
||||
Convert stripped TIFF image.
|
||||
*/
|
||||
- extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- extent+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
+ extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
if (strip_pixels == (unsigned char *) NULL)
|
||||
@@ -2002,13 +1997,8 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
number_pixels=(MagickSizeType) columns*rows;
|
||||
if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
- extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
+ extent=4*(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
TIFFTileSize(tiff));
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- extent+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*tile_pixels));
|
||||
if (tile_pixels == (unsigned char *) NULL)
|
||||
@@ -2101,11 +2091,6 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
if (HeapOverflowSanityCheck(image->rows,sizeof(*pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
number_pixels=(MagickSizeType) image->columns*image->rows;
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- number_pixels+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- number_pixels+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
|
||||
if (generic_info == (MemoryInfo *) NULL)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
22
CVE-2022-3213.patch
Normal file
22
CVE-2022-3213.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From 30ccf9a0da1f47161b5935a95be854fe84e6c2a2 Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Sat, 27 Aug 2022 08:38:57 -0400
|
||||
Subject: [PATCH] squash heap-buffer-overflow, PoC TIFF from Hardik
|
||||
|
||||
---
|
||||
coders/tiff.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 132008efbf..a166bea177 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1892,7 +1892,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
/*
|
||||
Convert stripped TIFF image.
|
||||
*/
|
||||
- extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
+ extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
if (strip_pixels == (unsigned char *) NULL)
|
||||
22
CVE-2022-44267_CVE-2022-44268.patch
Normal file
22
CVE-2022-44267_CVE-2022-44268.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From 05673e63c919e61ffa1107804d1138c46547a475 Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Sat, 22 Oct 2022 13:28:46 -0400
|
||||
Subject: [PATCH] possible DoS @ stdin (OCE-2022-70); possible arbitrary file
|
||||
leak (OCE-2022-72)
|
||||
|
||||
---
|
||||
coders/png.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/coders/png.c b/coders/png.c
|
||||
index c83d937c93..4f8c8909bf 100644
|
||||
--- a/coders/png.c
|
||||
+++ b/coders/png.c
|
||||
@@ -3980,6 +3980,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
|
||||
(void) FormatLocaleString(key,MagickPathExtent,"%s",
|
||||
text[i].key);
|
||||
if ((LocaleCompare(key,"version") == 0) ||
|
||||
+ (LocaleCompare(key,"profile") == 0) ||
|
||||
(LocaleCompare(key,"width") == 0))
|
||||
(void) FormatLocaleString(key,MagickPathExtent,"png:%s",
|
||||
text[i].key);
|
||||
@ -1,7 +1,7 @@
|
||||
Name: ImageMagick
|
||||
Epoch: 1
|
||||
Version: 7.1.0.28
|
||||
Release: 4
|
||||
Release: 5
|
||||
Summary: Create, edit, compose, or convert bitmap images
|
||||
License: ImageMagick and MIT
|
||||
Url: http://www.imagemagick.org/
|
||||
@ -10,6 +10,11 @@ Source0: https://github.com/ImageMagick/ImageMagick/archive/refs/tags/7.1
|
||||
Patch0001: backport-fix-CVE-2022-2719.patch
|
||||
Patch0002: backport-fix-CVE-2022-1115.patch
|
||||
Patch0003: CVE-2022-32547.patch
|
||||
Patch0004: CVE-2022-44267_CVE-2022-44268.patch
|
||||
Patch0005: CVE-2022-3213-pre1.patch
|
||||
Patch0006: CVE-2022-3213-pre2.patch
|
||||
Patch0007: CVE-2022-3213-pre3.patch
|
||||
Patch0008: CVE-2022-3213.patch
|
||||
|
||||
BuildRequires: bzip2-devel freetype-devel libjpeg-devel libpng-devel perl-generators
|
||||
BuildRequires: libtiff-devel giflib-devel zlib-devel perl-devel >= 5.8.1 jbigkit-devel
|
||||
@ -164,6 +169,9 @@ rm PerlMagick/demo/Generic.ttf
|
||||
%{_libdir}/pkgconfig/ImageMagick*
|
||||
|
||||
%changelog
|
||||
* Thu Feb 09 2023 yaoxin <yaoxin30@h-partners.com> - 1:7.1.0.28-5
|
||||
- Fix CVE-2022-44267,CVE-2022-44268 and CVE-2022-3213
|
||||
|
||||
* Tue Nov 22 2022 yaoxin <yaoxin30@h-partners.com> - 1:7.1.0.28-4
|
||||
- Fix CVE-2022-32547
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user